Changelog

What changed in each Kowan release: new features first, then fixes and other changes.

Each release lists first what changes for you; stability fixes and internal work are under "Other changes".

0.1.16 — 2026-10-31

Runbooks. Name the actions you run often on a workload, such as emptying a cache, migrating a database or reloading a configuration, and anyone with access runs them with a click. A runbook has one or more steps, on one workload or several, in a running container or in a throwaway copy of the service. Parameters reach the command as environment variables, never pasted into it. Each run is followed live and kept with its output. Find them in a tab of each workload, under Automation → Runbooks and in ⌘K. They can also be declared with kowan.runbook.* labels, scheduled, and run by AI assistants through MCP. Kowan suggests some from the workload's images.
Runbooks when an alert fires. An alert rule can run a runbook, at most once every few minutes for the same container. The steps read which container fired, on which host and why.
Crash snapshots. When a container dies with an error and nobody stopped it, Kowan saves its last logs, configuration, environment (secrets hidden) and recent resources at once, before a restart replaces it. They are in the workload's new Crashes tab.
Host groups. Put hosts in groups such as production or customer-x. A team permission, an auto-update default, a schedule or a runbook step can then cover a whole group, including hosts added to it later. Kowan's own containers are never stopped or updated by a group.
Inventory. Workloads → More → Export inventory downloads what runs where, as CSV or JSON.
Health. Settings → Health shows Kowan's own state: database size and free disk, the round trip to each host, whether the background work keeps up, and what is running now.

Other changes

Schedules can run a runbook or act on a host group.
Alerts say which container they are about.

0.1.15 — 2026-10-31

Updates in the workload list. Swarm services are now checked: a service has an update when its tag serves a newer image than the one swarm deployed, and Update rolls the service over through swarm. Old swarm tasks kept as history ("Replaced") no longer count as updates. When an image could not be compared, the list says Not checked, with the reason on hover, instead of "Up to date".
Registries over plain HTTP. A registry your Docker hosts list in insecure-registries, or one stored with the new Plain HTTP box, is checked for updates over HTTP.
Registries without a credential. Choose None for a public registry: pulls are anonymous.
Saving a registry checks it first. If the registry does not answer, the error shows in the form and nothing is saved, unless you choose Save without checking.
Progress for every pull. A panel in the corner shows each image being pulled, whatever started it (the Pull button, an update, a deploy, the auto-updater), with size and layers. The Pull and Update dialogs show their own. Team members see the pulls they started.
Removing several images leaves the ones in use. An image a running container uses, also by digest as swarm does, counts as in use and is skipped, instead of failing.

Other changes

Images are matched to containers by image id. The In use and Unused filters, and the update state of an image, no longer depend on the tag a container was created from.
Update the agents. Updating a swarm service on a remote host needs the agent of this release.

0.1.14 — 2026-10-31

Agents fix their own restart policy. An agent installed without a restart policy, as the join command did up to 0.1.12, sets unless-stopped on its own container when it starts, so it comes back after a reboot. Update your agents from Settings → Server updates and there is nothing to run by hand; a policy you chose is left as it is.

0.1.13 — 2026-10-31

What's new in the console. Settings → What's new shows what changed in each release, with the version this server runs marked.
Documentation on kowan.io. Installation, a guide for every feature and the reference for configuration, container labels, the CLI, the REST API and MCP, searchable, at kowan.io/docs.
Hosts by their name. A renamed host shows its name on the workload pages, in search and in the host menu, instead of its id (such as local).
Every user can change their password. Settings → General → Profile now works for operators and viewers too, and asks for the current password.
Agents come back after a reboot. The join command starts the agent with --restart unless-stopped.
Team permissions cover schedules, volume backups and auto-update. A team member sees and changes only those for the hosts, deployments and stacks they can access.
Safer teams and workflows. A team with API keys bound to it can no longer be deleted (its keys used to keep working with their full role). A workflow with a Backup step is admin-only and writes only inside the backups folder. A disabled workflow refuses its webhooks.
AI assistants follow the API roles. Through MCP, removing containers, images and volumes, pruning, disk cleanup and creating or destroying deployments need the operator role, as through the REST API, and destructive tools still ask for confirmation. An assistant no longer needs an admin key, which ignores team permissions.
Backups say what they hold. A Kowan backup includes the keys that decrypt your stored secrets, and Settings → General → Backup & Restore now says so: keep backups as safe as the server.

Other changes

kowanctl reads a flag, then the environment, then the config file. An environment variable now overrides the saved settings.
Compose validation warns about relative paths. A ./ bind mount, an env_file or a config file: resolves in a temporary folder on the host, not next to the original file.
Compose port checks are named port-in-use and port-duplicate again.
Clearer texts. The deployment's Configuration tab says when saving redeploys at once, the History tab names every revision source, registry links point at Settings → Registries, and the Users page no longer mentions LDAP.
Reconcile settings accept durations. KOWAN_RECONCILE_INTERVAL and KOWAN_RECONCILE_COOLDOWN take values such as 5s or 2m.

0.1.12 — 2026-10-30

CPU is a share of the whole host. 100% now means every core is busy, for containers, hosts and workloads alike; it used to be 100% per core, so a 4-core host could read 400%. Remote hosts switch once their agent is updated.
A stopped container is no longer a crash. A container stopped on purpose that exits with an error code (as npm start does) shows as Stopped, without the degraded state or the "container exited" alert.

Other changes

CPU of a workload on several hosts. The hosts' average, and the busiest host's peak.
Tests no longer hang on Python 3.10. The test runner also stops a module that runs too long and shows where it hung.

0.1.11 — 2026-10-28

Update a whole workload. "Update · N" in a workload's header updates every service with a newer image at once, verified, and rolled back service by service if one fails.
Newer version tags. "New versions · N" offers the newer tags of a pinned image (api:2.0 → api:2.1) and shows what will change before applying it as a new revision.
Deploy a registry from Kowan. Registries → Deploy a registry runs one on a host behind Traefik with a Let's Encrypt certificate, with an optional login.
Pull image asks for the registry first. Browse a stored registry's repositories and tags, or type an image and see which credentials the pull uses.

Other changes

Compose deploys pull with the stored credentials. A new tag on AWS ECR no longer needs a manual pull first.
Updating the agents no longer marks deployments as failed. Kowan waits for the host to come back instead of redeploying.
Updating a container of a deployment updates the deployment. The next deploy no longer undoes it.

0.1.10 — 2026-10-28

The MCP server covers the whole of Kowan. 51 tools: an assistant sees workloads as the console does, searches logs, reads resource history, revisions and audit, rolls back, promotes and plans a disk cleanup. See docs/mcp.md.

0.1.9 — 2026-10-28

Search (⌘K) finds workloads. Stacks and deployments show next to containers, hosts and pages, ranked by match and filtered by kind; empty, it opens on what needs attention.

Other changes

Update checks work for images on AWS ECR. They use the ECR credentials configured for the host.

0.1.8 — 2026-10-28

Agents update together. Every agent updates at the same time with its own health check, and one that fails rolls back alone.
The update dialog shows progress. Every host stays listed while it restarts, with a bar for its current step and one for the whole update.

0.1.7 — 2026-10-27

A new look, the same on every page. A header card with breadcrumb, title, facts and actions; sections in cards, tabs in a toolbar.
Workloads in tabs. All, Managed and Not managed.
A clearer workload page. CPU, memory and network side by side; updates, backups, schedule and domains switched inline.
A clearer container page. How it runs and how it is wired in one card, with live resources and its stack beside it.
A host's overview. Its resources, the first workloads and what needs attention.

0.1.6 — 2026-10-27

Other changes

Updating an agent or restarting the server no longer marks deployments as failed. An unreachable host is left alone until it is back. A deployment already marked this way needs one Redeploy.

0.1.5 — 2026-10-27

Update to the new release in one click. A server or agent pinned to a release (kowan:0.1.3) now moves to the newest one; the button says which ("Update to 0.1.4").

0.1.4 — 2026-10-27

Browsing large volumes no longer uses memory. Browse, download and upload stream through server and agent; a huge folder shows its first 5000 entries.

Other changes

Bounded memory for incoming data. Tunnel streams, exec output, the agent protocol and every outbound HTTP call have a limit.
Lighter host metrics. Long ranges come back as at most 720 points.
Less background work. One container list per host per reconcile pass, and stale state dropped from memory.
Lighter agent and image. httpx is gone and the agent skips server-only modules.
Lighter interface. Log streams pause in hidden tabs and the CSS is 30 KiB smaller.
Removed unused API. GET /scans/summary and the kowan.hidden label; volume browse answers {entries, truncated}.

0.1.3 — 2026-10-26

Settings in the sidebar. At the bottom, instead of in the account menu.
Kowan's own containers are hidden. Out of Workloads, the dashboard, Logs and search; Settings → Features shows them again.
A missing compose service shows and heals. The workload turns red naming what is missing, Needs you gets a card, and the deployment is redeployed.
Workload services fold. Each with its state and replicas ("1 + 4 replaced").
Scale a service in place. A Replicas control writes deploy.replicas into the compose as a new revision and redeploys.
Images: updates and bulk remove. An Update column, an on-the-spot check and pull, filters and multi-select.
Switching host opens its overview.

Other changes

Old Swarm tasks are no longer crashes. A task replaced in its slot shows as "Replaced".
Replica counts. "x/y" is replicas up out of those requested, per service or Swarm slot.
Faster self-healing. The reconcile loop runs every 5 s (KOWAN_RECONCILE_INTERVAL); the 120 s cooldown per deployment stays.
Ports, mounts and networks in a fixed order.
No leftover auto-update policies. A policy set back to the defaults is removed.

0.1.2 — 2026-10-26

New release notices. The bell says when a newer Kowan is out (checked every 6 hours; KOWAN_RELEASE_REPOSITORY).
Running and latest version in Settings. Also when running from source; Check asks the registry again.
Auto theme. Follows the system, and is the default.
Stack variables. Values for a compose deployment's ${VAR}s, like a Portainer stack's environment, with revisions and masking.
Config or secret, per variable. A secret value goes to an encrypted secret the deployment owns and is never shown back.
Features on/off. Templates, Network map and GitOps can be turned off for everyone in Settings.
Portainer import, reworked. Environments become stack variables, and connections are kept in Credentials.
Container actions everywhere. Kill, and a "⋯" menu on every container of a workload.
Environment variables up front. Their own section when creating or editing a container deployment.

Other changes

Deployments restart right after the host boots. The reconcile loop no longer waits for its cooldown.
A stability window of 0 seconds is honoured. It used to wait 10 seconds after every auto-update.
Faster backend tests. One module per CPU: about 26 s instead of 2.5 min.

0.1.1 — 2026-10-26

Rename hosts. The local one included, from its page, the Hosts list or kowanctl hosts rename.
Copy buttons work over plain HTTP.
Two-level stacks. In Workloads a stack lists its services, each with its containers.
Portainer import keeps variables encrypted. A stack's variables go to an encrypted secret.

Other changes

The frontend builds with Node 26.
CI fixes. coverage 7.16.2 on Python 3.10, and the end-to-end test matches the Overview tab.
Documentation, the changelog and the Makefile are in English.

0.1.0 — 2026-10-26

First public release: images ghcr.io/kowan-lab/kowan and ghcr.io/kowan-lab/kowan-agent (amd64 and arm64), the CLI with pip install git+https://github.com/kowan-lab/kowan. MIT license.

Server, agent and CLI. A Python control plane with SQLite; agents over an authenticated tunnel, behind NAT too; kowanctl for the terminal.
Docker resources. Every host's containers, images, volumes and networks, with live logs, a web console and a file browser.
Deployments. From an editor, a template or git, with revisions, rollback, branch previews, promotion and import.
Safe updates. Trivy scans, auto-update with maintenance windows and rollback, self-updates for server and agents.
Exposure, backups and automation. HTTPS through Traefik, network map, volume backups with restic, schedules, GitOps, workflows and webhooks.
Observability. Uptime and status page, searchable logs, resource history, alerts, digest, disk cleanup.
Access. Roles, teams, SSO, API keys, audit log, network allowlists and an MCP server.
A React interface. Six themes, usable on a phone and installable as an app.